Security Engineer interview question

Explain a TLS downgrade attack and how you would prevent it.

What interviewers are really testing

• Protocol-level understanding of negotiation tampering
• Concrete mitigations, not vibes
• Legacy protocol risk awareness

A strong answer framework

1. Attacker tampers with negotiation to force weak protocol or cipher
2. Downgraded channel then exploited (POODLE-style)
3. Disable legacy protocols and weak ciphers server-side
4. Enforce TLS 1.2+ with AEAD ciphers, plus HSTS
5. Validate with testssl.sh and alert on anomalous handshakes

Follow-ups you should be ready for

• What does HSTS actually prevent here?
• TLS 1.2 vs 1.3 handshake differences?

More real Security Engineer interview questions

• A domain controller is making outbound connections to an external IP on port 443. No maintenance is scheduled. How do you investigate?
• A user reports clicking a link in a phishing email. Walk me through your response.
• How would you write a Splunk search to detect multiple failed logins followed by a success?